CVE-2015-7547

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS 3.08.1High EPSS percentile99th91% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 6 sources FixVendor fixNo build named by the sources

Published 2016-02-18Updated 2026-05-06Sources: CVE.org, NVD, BDU, CSAF

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check the glibc/libc6 version on each affected machine (you need libc6/glibc older than 2.23 to be at risk).
Verify whether the machine performs DNS lookups in normal operation (especially IPv6/dual-stack address resolution) and whether it can receive network traffic from untrusted sources.
Upgrade glibc/libc6 to version 2.23 or higher on all hosts that run the vulnerable glibc.
Re-test: restart services that use name resolution and confirm normal operation after the upgrade.

Vendor advisory Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module.

In plain language

Written by AI from the record

CVE-2015-7547 is a glibc (libc6) security bug (in versions older than 2.23) that lets attackers send a specially crafted DNS reply to crash services or, more rarely, potentially run malicious code—if your server uses DNS lookups over the network with IPv6-capable settings. Most small businesses should act if this machine is internet-facing or performs network DNS resolution.

CVE-2015-7547 is a set of stack-based buffer overflows in glibc’s libresolv functions (send_dg/send_vc) in libc6 before 2.23, triggered by a specially crafted DNS response during getaddrinfo resolution for IPv6/dual-stack DNS behavior; it can be reached over the network with no authentication or user interaction.

If you're affected

Service crashes and outages
Possible remote code execution
Security incident risk

What is it

Your system uses a core library (glibc/libc6) to translate names (like web addresses) into network addresses. This bug can be triggered by a malicious DNS reply that looks normal enough to pass through, but is specially crafted to overflow internal buffers. The most common outcome is the service crashing (denial of service); in rarer cases, the attacker could potentially run code on the machine.

Who is affected

This matters to you if you run a Linux system using GNU C Library (glibc / libc6) version older than 2.23, including common distro packages such as Debian/Ubuntu (and similar enterprise/unified offerings listed).

The risk is relevant because it is reachable over the network in default configuration, without authentication or user interaction. Practically, it’s most urgent for machines that receive untrusted network traffic and perform DNS resolution with IPv6-capable/dual-stack behavior (e.g., typical server name lookups).

How urgent is it

Attackers can exploit this remotely by sending crafted DNS responses, and it’s reachable in default configuration—so exposed systems are at real risk. Because the system impact ranges from crashes to possible code execution and public exploits exist, you should treat this as an immediate patching priority for affected hosts.

Overall urgency is AMBER: act quickly, starting with internet-facing systems and anything that does DNS lookups over IPv6/dual-stack.

What to do — in detail

Confirm exposure

On each relevant server, check the installed glibc/libc6 version.
- Debian/Ubuntu-style systems (typical): run dpkg -l | grep -E '^ii\s+libc6\s'
- Another common approach: ldd --version (shows the glibc version).
If the version is older than 2.23, the host is affected.

Identify where it matters most

Identify services that do DNS resolution as part of normal operation (for example: web servers/proxies, mail services, VPN/UTM, internal components that resolve names, or anything resolving clients/targets using getaddrinfo with IPv6/dual-stack behavior).
Prioritize systems that are reachable from the internet or untrusted networks.

Upgrade / remediation (the fix)

Upgrade glibc/libc6 to 2.23 or higher.
- Follow your Linux vendor’s recommended update process (package update/upgrade) because glibc is tightly integrated with the OS.
After upgrading, restart the services that use DNS/name resolution.

If you can’t patch immediately (workaround)

Reduce exposure by limiting which external parties can influence DNS responses:
- Ensure DNS resolution is done via trusted resolvers under your control.
- Where possible, restrict outbound DNS traffic and monitor for unusual DNS activity.
- If your environment supports it, temporarily limit IPv6/dual-stack DNS resolution paths on affected services until patched (do this only if your operations can tolerate it).

What to monitor

Watch for:
- Service crashes/restarts related to name resolution.
- Unexpected DNS query patterns from hosts (especially around IPv6/AAAA lookups).
- System logs for errors around DNS resolution during time windows when network traffic occurred.

Timing guidance

CVE-2015-7547 is not listed in CISA KEV, but public exploits exist; patch affected hosts as soon as possible, prioritizing internet-facing and DNS-heavy systems.

Technical context

Severity and what it does

CVE-2015-7547 is a high-impact glibc issue (CWE-119) that can lead to denial of service (crash) and possibly remote code execution. The triggering behavior is a crafted DNS response that causes glibc’s libresolv code paths (send_dg/send_vc) to overflow stack buffers during getaddrinfo-based address resolution.

Attack vector and reachability

Remote / network-reachable, with no authentication and no user interaction.
Affected condition: the system must have glibc/libc6 older than 2.23.
Findings indicate it is reachable in default configuration.

Exploitation status

Public exploits are available (multiple known), and press attention is rising.
KEV is not listed here, so this is not described as confirmed KEV exploitation in the provided findings.

Fix

The provided patch guidance points to updating glibc to 2.23 or higher (vendor remediation references are included in the findings).

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

6 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

91% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Rising.

Real risk signals with little public attention so far.

Lifecycle

A public exploit existed 61 days before the patch.

2026-09-23EPSS band changehigh → criticalepss band change
2026-09-21EPSS band changecritical → highepss band change
2026-09-06EPSS band changehigh → criticalepss band change
2026-09-05EPSS band changecritical → highepss band change
2026-08-31EPSS band changehigh → criticalepss band change
2026-08-29EPSS band changecritical → high

Affected products

f5commercial · US
- big-ip access policy managerNetwork DeviceOn-premNetworking Infrastructure / firewall
- big-ip advanced firewall managerSecurity ProductOn-premNetworking Infrastructure / firewall
- big-ip analyticsNetwork DeviceOn-premNetworking Infrastructure / network-management
- big-ip application acceleration managerNetwork DeviceOn-premNetworking Infrastructure / load-balancer-proxy
- big-ip application security managerNetwork DeviceOn-premNetworking Infrastructure / firewall
- big-ip domain name systemOn-premNetworking Infrastructure / dns-dhcp-ntp
- big-ip link controllerNetwork DeviceOn-premNetworking Infrastructure / router-switch
- big-ip local traffic managerNetwork DeviceOn-premNetworking Infrastructure / load-balancer-proxy
susecommercial · DE
redhatcommercial · USaka red hat
hpcommercial · USaka hewlett packard, hpe
- helion openstackWeb AppOn-premCloud & SaaS / cloud-platform
- server migration packOn-premEnterprise Software / itsm-monitoring
oraclecommercial · USaka oracle corp.
- exalogic infrastructureOn-premCloud & SaaS / virtualization
- fujitsu m10 firmwareFirmwareEmbeddedHardware Firmware
debianoss-project · GBaka debian gnu/linux
- debian linuxOSOn-premOperating Systems / linux-distro

And 12 more affected products. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 8.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable